# CVE-2026-54462: Knative pkg webhook admission memory exhaustion

Source: https://junglewise.ai/threats/cve-2026-54462-knative-pkg-provides-common-packages-shared-across-knative  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-54462 · Severity: medium · CVSS 6.5 · Published 2026-10-27

Knative pkg is a shared library used by multiple Kubernetes admission webhook controllers, including Knative, Tekton, KEDA, and Sigstore policy-controller. The library fails to limit the size of incoming admission requests, allowing a pod-network attacker to send an oversized request that consumes all available memory and crashes the webhook controller. This can delay or block critical admission decisions for cluster workloads.

Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Sigstore](https://junglewise.ai/threats/vendors/sigstore).

## Quick answers

**Is CVE-2026-54462 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54462 being exploited in the wild.

**How severe is CVE-2026-54462?** Medium severity, with a CVSS score of 6.5, published 27 October 2026.

**Which products and versions are affected?** CD Foundation Tekton all versions using affected pkg; knative.dev/pkg (Go) SEMVER:introduced=0,fixed=0.0.0-20260531000007-52dbd5ece63f; KEDA all versions using affected pkg; Knative all versions using affected pkg; and 3 more.

**Is there a fix for CVE-2026-54462?** Yes. knative.dev/pkg (Go): upgrade to 0.0.0-20260531000007-52dbd5ece63f or later. Until then: Restrict network access to admission webhook endpoints to trusted control-plane clients only, or configure the webhook with failurePolicy=Ignore to allow other admissions to proceed if the webhook becomes unavailable. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54462 attacked?** It is attacked over the network or from the adjacent network, in a software library.

**Am I affected by CVE-2026-54462?** Check whether you run CD Foundation Tekton, knative.dev/pkg (Go), KEDA or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- knative.dev/pkg (Go): upgrade to 0.0.0-20260531000007-52dbd5ece63f or later

  ```sh
  go get knative.dev/pkg@v0.0.0-20260531000007-52dbd5ece63f
  ```


Restrict network access to admission webhook endpoints to trusted control-plane clients only, or configure the webhook with failurePolicy=Ignore to allow other admissions to proceed if the webhook becomes unavailable.

## Technical details

The admission webhook handler in webhook/admission.go decodes untrusted AdmissionReview JSON using json.NewDecoder(io.TeeReader(r.Body, &bodyBuffer)) without an http.MaxBytesReader or body-size limit, causing both the decoder and buffer to hold amplified copies of large requests in memory. An unauthenticated pod-network attacker can trigger an out-of-memory condition, killing the webhook controller process. The fix adds an http.MaxBytesHandler with a 3 MiB limit to truncate oversized requests.

## Affected products

- Knative pkg prior to 0.0.0-20260531000007-52dbd5ece63f
- Knative Knative all versions using affected pkg
- CD Foundation Tekton all versions using affected pkg
- KEDA KEDA all versions using affected pkg
- Sigstore policy-controller all versions using affected pkg
- Kpack Kpack all versions using affected pkg

## Identifiers

- CVE-2026-54462
- GHSA-2hw4-c9m4-f2fj
- GO-2026-6880

## Timeline

- 2026-05-31: patched: Fix merged limiting webhook body size to 3 MiB
- 2026-10-27: advisory: CVE-2026-54462 published

## References

- [https://github.com/knative/pkg/commit/52dbd5ece63fe6d2d340ecbebec160550f460818](https://github.com/knative/pkg/commit/52dbd5ece63fe6d2d340ecbebec160550f460818)
- [https://github.com/knative/pkg/pull/3363](https://github.com/knative/pkg/pull/3363)

## Related threats

- [KEDA privilege escalation from namespace admin to cluster admin via TriggerAuthentication](https://junglewise.ai/threats/cve-2026-77524-keda-privilege-escalation-from-namespace-admin-to-cluster-admin)